The report is about User and Entity Behavioral Analytics (UEBA) platforms used in the Incident Detection and Response (IDR) lifecycle and machine learning in various procedures in cybersecurity technologies. UEBA platforms apply algorithms over unstructured data sets to locate anomalies. By using a algorithm-based approach, UEBA is not limited to what can be learned from signatures or from techniques that require packet parsing. Divorced from signatures and packets, UEBA platforms are positioned to detect threats not possible in traditional cyber defense tools. UEBA platforms are deployed (typically) as plug-ins to network ingress/egress points and do not require agents or sensors (although additional visibility and endpoint management with the deployments of agents could be gained).If a UEBA platform is trusted, it can reduce agent management, and more importantly, reduce the number of alerts facing SOC analysts.

Research Highlights

The report is about User and Entity Behavioral Analytics (UEBA) platforms used in the Incident Detection and Response (IDR) lifecycle and machine learning in various procedures in cybersecurity technologies.

By using a math-based approach, UEBA is not limited to what can be learned from signatures or from techniques that require packet parsing.

Divorced from signatures and packets, UEBA platforms may be able to detect threats not possible in traditional cyber defense tools.

UEBA platforms are deployed (typically) as plug-ins to network ingress/egress points and do not require agents or sensors (although additional visibility and endpoint management with the deployments of agents could be gained).

If a UEBA platform is trusted, it can reduce lightweight agent management, and more importantly, reduce the number of alerts facing SOC analysts.